Exergie/NeoECU-Hardware
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

Homogenized labels and added crank and cam sensor inputs

Browse Source
This commit is contained in:
h3cx
2026-09-10 23:26:54 +02:00
parent 0de94168f7
commit 45c0d7f8ec
7 changed files with 266 additions and 96 deletions
Download Patch File Download Diff File Expand all files Collapse all files
Architecture/IO_MODULES/DEAD_MAN.md
+58 -27
View File
@@ -3,9 +3,12 @@
## Purpose
This module provides the hardware run-permission path for the engine outputs.
The steering-wheel dead-man switch must be held to assert permission. Releasing
the switch, an open circuit, loss of a logic supply, or MCU reset must place
the engine outputs in their non-energising state independently of firmware.
The steering-wheel dead-man switch must be held to assert permission. Two
electrically independent, normally-open switch contacts and two independent
harness signal paths are required. Releasing the switch, an open circuit,
one signal path shorted to the 5 V source, loss of a logic supply, or MCU reset
must place the engine outputs in their non-energising state independently of
firmware.
This document defines the signal relationships and destinations only. Output
driver implementation is documented separately.
@@ -14,18 +17,31 @@ driver implementation is documented separately.
| Signal | Domain | Active state | Default/fault state |
| --- | --- | --- | --- |
| `DEAD_MAN_SIG` | Protected 5 V logic | High: driver is holding the dead-man switch | Low: no permission |
| `DEADMAN_A_HELD` | Protected 5 V logic | High: deadman channel A observes its contact held | Low: released or fault |
| `DEADMAN_B_RELEASED` | Protected 5 V logic | High: deadman channel B does not observe its contact held | Low: contact held |
| `DEADMAN_OK` | Protected 5 V logic | High: channels have the valid held-state relationship | Low: released or fault |
| `MCU_RUN_PERMIT` | 3.3 V MCU logic | High: MCU permits engine operation | Low: no permission |
| `ENGINE_PERMIT` | 5 V logic | High: both hardware and MCU permit operation | Low: no permission |
| `MCU_INJECTOR_SIG` | 3.3 V MCU logic | High: requested injector on-time | Low: injector off |
| `SAFE_INJECTOR_SIG` | 5 V logic | High: permitted injector command | Low: injector off |
| `SAFE_IGNITION_INHIBIT` | 5 V logic | High: ignition output is inhibited | Low: ignition output is permitted |
| `DEAD_MAN_STATUS` | 3.3 V MCU input | High: observed dead-man asserted | Low: observed dead-man released/faulted |
| `DEADMAN_A_STATUS` | 3.3 V MCU input | High: channel A contact is observed held | Low: released or fault |
| `DEADMAN_B_STATUS` | 3.3 V MCU input | High: channel B contact is observed held | Low: released or fault |
`DEAD_MAN_SIG` is a harness-connected input. It shall be protected, filtered,
and given a default-low bias before entering the 5 V logic. The conditioning
must tolerate expected connector faults and transients without allowing a
fault to assert engine permission.
Each deadman contact has its own harness signal, connector pin, connector-side
protection, series/filter network, and default-low bias. The contacts may share
the protected 5 V source at the switch, but neither signal path may share a
pull-up, pull-down, connector pin, or post-contact conductor with the other.
Each contact closes to the protected 5 V source only while the driver holds the
switch. Thus an open signal path reads low; a short of only one signal path to
the source cannot create the valid two-channel state.
Channel A is conditioned non-inverting to create `DEADMAN_A_HELD`. Channel B
is conditioned inverting to create `DEADMAN_B_RELEASED`. This complementary
encoding makes the sole valid held state `A = high`, `B = low`. Both raw,
conditioned contact observations also enter protected 3.3 V MCU inputs as
`DEADMAN_A_STATUS` and `DEADMAN_B_STATUS`; these are diagnostic observations,
not the safety-critical shutoff path.
## Signal tree
@@ -33,23 +49,27 @@ The permission gates operate from `+5V_MAIN` and accept 3.3 V MCU logic
levels. Their outputs are 5 V logic levels.
```text
protected steering-wheel input
|
+--> protected 3.3 V observation path --> DEAD_MAN_STATUS --> MCU
|
+--> conditioned 5 V DEAD_MAN_SIG --+
AND --> ENGINE_PERMIT --+
MCU_RUN_PERMIT --------------------------------+ |
+--> ignition-permission inverter
| --> SAFE_IGNITION_INHIBIT
|
MCU_INJECTOR_SIG -------------------------------------------------------AND --> SAFE_INJECTOR_SIG
protected 5 V --> independent NO contact A --> protected A input
+--> 3.3 V --> DEADMAN_A_STATUS --> MCU
`--> 5 V --> DEADMAN_A_HELD -----+
|
protected 5 V --> independent NO contact B --> protected B input +--> AND --> DEADMAN_OK --+
+--> 3.3 V --> DEADMAN_B_STATUS --> MCU ^ |
`--> inverter --> DEADMAN_B_RELEASED -- NOT-+ |
|
MCU_RUN_PERMIT ---------------------------------------------------------------------------------------------AND --> ENGINE_PERMIT --+
|
ignition-permission inverter
--> SAFE_IGNITION_INHIBIT
MCU_INJECTOR_SIG -------------------------------------------------------------------------------------------AND --> SAFE_INJECTOR_SIG
```
The logic equations are:
```text
ENGINE_PERMIT = DEAD_MAN_SIG AND MCU_RUN_PERMIT
DEADMAN_OK = DEADMAN_A_HELD AND NOT(DEADMAN_B_RELEASED)
ENGINE_PERMIT = DEADMAN_OK AND MCU_RUN_PERMIT
SAFE_INJECTOR_SIG = ENGINE_PERMIT AND MCU_INJECTOR_SIG
SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
```
@@ -61,12 +81,22 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
| `ENGINE_PERMIT` | Hardware injection-command permission gate | Must prevent an injector command from reaching the injection output stage when low. |
| `SAFE_INJECTOR_SIG` | Dedicated injection output stage command input | The only injector on-command presented to the output stage. |
| `SAFE_IGNITION_INHIBIT` | Dedicated ignition output stage inhibit/enable input | Must inhibit the ignition output stage when high and permit it only when low. |
| `DEAD_MAN_STATUS` | STM32 digital input | Firmware observation, scheduling shutdown, telemetry, and diagnostics only; it is not the safety-critical shutoff path. |
| `DEADMAN_A_STATUS`, `DEADMAN_B_STATUS` | STM32 digital inputs | Firmware observes both contacts, detects disagreement, clears schedules, and reports diagnostics. Neither input is the safety-critical shutoff path. |
## Fail-safe behavior
- `DEAD_MAN_SIG` must be low if the steering-wheel switch is released, its
wire opens, or its source is unavailable.
- With the switch released, the valid relationship is
`DEADMAN_A_HELD = low` and `DEADMAN_B_RELEASED = high`; `DEADMAN_OK` is low.
- With the switch held, the only permissive relationship is
`DEADMAN_A_HELD = high` and `DEADMAN_B_RELEASED = low`; `DEADMAN_OK` is high.
- An open circuit, an open contact, or a short to the 5 V source on either one
signal path produces a non-permissive relationship. A short to ground on a
held path also removes permission.
- This architecture protects against one fault in one contact or signal path.
It does not claim to detect a common-mode fault that energises both input
paths, or simultaneous faults in both contacts/paths. Harness routing and
connector assignment shall minimise such common-mode faults; any remaining
risk requires explicit system-level acceptance.
- `MCU_RUN_PERMIT` and `MCU_INJECTOR_SIG` must default low during reset,
boot, brownout, or an unpowered MCU. External bias components shall provide
these states during power sequencing.
@@ -82,7 +112,8 @@ SAFE_IGNITION_INHIBIT = NOT(ENGINE_PERMIT)
## Firmware responsibilities
The hardware path is authoritative; firmware cannot override a released
dead-man switch. Firmware shall nevertheless sample `DEAD_MAN_STATUS`, clear
pending injection and ignition schedules when it becomes invalid, and keep
The hardware path is authoritative; firmware cannot override a released or
faulted deadman switch. Firmware shall sample both `DEADMAN_A_STATUS` and
`DEADMAN_B_STATUS`, clear pending injection and ignition schedules on a
released state or disagreement, report any disagreement, and keep
`MCU_RUN_PERMIT` low except while engine operation is intentionally enabled.